TornadoRoad46 Posted January 24, 2023 ID:1551249 Share Posted January 24, 2023 I have two (private) Minecraft servers, one on port 25565 and one on port 25566. They run 24/7. I recently installed malwarebytes on the machine and have been getting a lot of RTP detections out of nowhere. I reset windows and they still come in. The only thing installed on the computer is Geforce Experience, Java, Malwarebytes, and Chrome. All the RTP detections come from the port 25565 ONLY. It seems like something is trying to attack one of my minecraft servers? This machine for sure has no virus and has been scanned multiple times. After looking up the IP's, they seem to be coming from datacenters? Those include Akamai Technologies, DoD Network Information, Doval Manuel Angel, OVH SAS, and DigitalOcean LLC. The RTP detection comes at random times, heres an example. 1 detection at 3:31 and 1 detection at 3:32.....1 detection at 3:43 and 1 detection at 3:44...etc. I will provide some logs, but please note that I dont have all the detections logs because I reset Windows recently. This is also NOT my main machine. 4.txt 3.txt 2.txt 1.txt Link to post Share on other sites More sharing options...
1PW Posted January 24, 2023 ID:1551254 Share Posted January 24, 2023 Hello @TornadoRoad46 and : While you are waiting for the next qualified/approved malware removal expert helper to weigh in on your topic, and even though you may have run the following Malwarebytes utility, please carefully follow these instructions: Download the Malwarebytes Support Tool. In your Downloads folder, open the mb-support-x.x.x.xxx.exe file. In the User Account Control (UAC) pop-up window, click Yes to continue the installation. Run the MBST Support Tool. In the left navigation pane of the Malwarebytes Support Tool, click Advanced. In the Advanced Options, click only Gather Logs. A status diagram displays the tool is Getting logs from your computer. A zip file named mbst-grab-results.zip will be saved to the Public desktop, please attach that file in your next reply to this topic. For the short time between when you post the diagnostic logs, and when your helper weighs in, please take no further self-directed remedial actions that will invalidate the diagnostic logs you will have sent. Thank you. Link to post Share on other sites More sharing options...
TornadoRoad46 Posted January 24, 2023 Author ID:1551258 Share Posted January 24, 2023 Here is the log file: mbst-grab-results.zip 1 Link to post Share on other sites More sharing options...
Porthos Posted January 24, 2023 ID:1551263 Share Posted January 24, 2023 1 hour ago, TornadoRoad46 said: I have two (private) Minecraft servers, one on port 25565 and one on port 25566. They run 24/7. I recently installed malwarebytes on the machine and have been getting a lot of RTP detections out of nowhere. I assume these servers are for you and your friends (not in you physical location) can play on them. I assume you are using a java based version of your minecraft server. Bottom line even with the blocks, are you or your other players having difficulty connecting and playing??? Link to post Share on other sites More sharing options...
TornadoRoad46 Posted January 24, 2023 Author ID:1551264 Share Posted January 24, 2023 9 minutes ago, Porthos said: I assume these servers are for you and your friends (not in you physical location) can play on them. I assume you are using a java based version of your minecraft server. Bottom line even with the blocks, are you or your other players having difficulty connecting and playing??? We can play the servers just fine with no lag, never have had a connectivity problem. Link to post Share on other sites More sharing options...
Porthos Posted January 24, 2023 ID:1551265 Share Posted January 24, 2023 6 minutes ago, TornadoRoad46 said: We can play the servers just fine with no lag, never have had a connectivity problem. No one actually uses this machine to actually play the game it just sits there as a server, correct? Link to post Share on other sites More sharing options...
TornadoRoad46 Posted January 24, 2023 Author ID:1551266 Share Posted January 24, 2023 Just now, Porthos said: No one actually uses this machine to actually play the game it just sits there as a server, correct? That would be correct Link to post Share on other sites More sharing options...
Porthos Posted January 24, 2023 ID:1551267 Share Posted January 24, 2023 Just now, TornadoRoad46 said: That would be correct Then You do not have to worry about the blocks. Malwarebytes is just blocking the brute force attacks on the machine trying to attack the very vulnerable Java. This is a good thing. I assume you do even keep the monitor on all the time since just sits there as a server. Out of sight out of mind i say. Link to post Share on other sites More sharing options...
TornadoRoad46 Posted January 24, 2023 Author ID:1551268 Share Posted January 24, 2023 Just now, Porthos said: Then You do not have to worry about the blocks. Malwarebytes is just blocking the brute force attacks on the machine trying to attack the very vulnerable Java. This is a good thing. I assume you do even keep the monitor on all the time since just sits there as a server. Out of sight out of mind i say. I use a program called Chrome Remote Desktop as I do not have an extra monitor on hand. Thank you for the information! Link to post Share on other sites More sharing options...
Porthos Posted January 24, 2023 ID:1551269 Share Posted January 24, 2023 @TornadoRoad46 I suggest you go back into Malwarebytes and put the database updates back to hourly or you can miss an important database update and reduce your protection. Quote Check for Updates Every 7200 Minutes Please keep that version of Java up to date as well for security. Link to post Share on other sites More sharing options...
TornadoRoad46 Posted January 24, 2023 Author ID:1551330 Share Posted January 24, 2023 11 hours ago, Porthos said: @TornadoRoad46 I suggest you go back into Malwarebytes and put the database updates back to hourly or you can miss an important database update and reduce your protection. Please keep that version of Java up to date as well for security. One more question, why were inbound connections coming from port 25565 only? I would think they would come from port 25565 and 25566 since they are both Java Minecraft servers. Link to post Share on other sites More sharing options...
Porthos Posted January 24, 2023 ID:1551340 Share Posted January 24, 2023 There is no rhyme or reason. It seems the other one is not getting hit. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted February 9, 2023 Root Admin ID:1553786 Share Posted February 9, 2023 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Please review the following to help you better protect your computer and privacy Tips to help protect from infection Thank you Link to post Share on other sites More sharing options...
Recommended Posts